Product:
TeamViewer DEX Platform On-Premises
Summary
A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions. Exploitation could lead to execution of elevated commands on devices connected to the platform.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2026-2695 |
Exploitation
To exploit this vulnerability, an authenticated user with questioner privileges can craft specific input that bypasses the input validation mechanisms. By injecting malicious commands into the instructions, the attacker can execute elevated commands on connected devices, potentially compromising their integrity and confidentiality.
Affected Products
- TeamViewer DEX Platform On-Premises: Vulnerable prior to version 9.2, allowing command injection through improper input validation.
Mitigation
To mitigate this vulnerability, users should upgrade to version 9.2 or later of the TeamViewer DEX Platform On-Premises. Additionally, it is recommended to review user privileges and limit access to only those who require it to minimize the risk of exploitation.